Apache

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Apache InLong. Thi

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Apache InLong. Thi

Uncontrolled Resource Consumption vulnerability in Apache InLong. Users could affect operational configuration or allow

Uncontrolled Resource Consumption vulnerability in Apache InLong. Non-template responsible persons can view template inf

Allocation of resources without limits or throttling vulnerability in Apache Struts. When no fixed locale is configured,

Uncontrolled resource consumption vulnerability in Apache Struts. An application that exposes an endpoint collecting Con

Exposure of data element to wrong session vulnerability in the JSON plugin of Apache Struts. Per-response serialization

Exposure of data element to wrong session vulnerability in the JSON plugin of Apache Struts. Per-request parsing state c

Uncontrolled resource consumption vulnerability in the JSON plugin of Apache Struts. When an application is configured t

Specifically crafted inputs may lead to git argument injection in Apache Allura. This issue affects Apache Allura: befo

Insecure Direct Object Reference (IDOR) due to missing permission checks for multiple Artifact types in Apache Allura.

XSS vulnerability in code display in Apache Allura. This issue affects Apache Allura: before 1.19.1. Users are recomme

XSS vulnerability in Markdown handling in Apache Allura. This issue affects Apache Allura: from 1.10.0 before 1.19.1.

Apache Airflow's asset materialization endpoint (`POST /api/v2/assets/{asset_id}/materialize`) and the XCom result check

Apache Airflow's Task SDK did not mask the contents of a Variable whose JSON value is a list, so secrets stored in that

Apache Airflow wrote Variable values and Connection `extra` contents to the audit log in cleartext when they were submit

Apache Airflow's Backfill API authorized a request against a Dag id supplied by the caller whenever the `backfill_id` pa

Apache Airflow's environment-variable secrets backend resolved a team-scoped Connection or Variable from the wrong team'

Apache Airflow's Task SDK rebuilt a `Callback` object from serialized data by re-running its constructor, which imports

Apache Airflow 3.3.0 moved human-in-the-loop tasks from the triggerer to a new `awaiting_input` task state swept by the

Apache Airflow's Config API did not mask team-scoped sensitive configuration values in multi-team deployments. When an a

Apache Airflow's secrets masker did not mask `var.json` Variable values whose value is a dict in the Rendered Templates

Apache Airflow's XCom `GET /api/v2/{...}/xcomEntries/{key}?deserialize=true` endpoint passed a string-literal payload th

Apache Airflow's serialization layer reconstructed exception nodes by calling `import_string()` on a class name taken fr

Apache Airflow's secrets masker hides values stored under sensitive key names when they are displayed in the UI. The mas

The Google Cloud Secret Manager secrets backend in Apache Airflow's Google provider never applied the team scope when re

Improper TLS hostname verification vulnerability in Apache HttpComponents Client 5.4 or newer. HostnameVerificationPolic

Apache Allura's webhooks are vulnerable to Server-Side Request Forgery (SSRF). This issue affects Apache Allura: before

The AWS Systems Manager Parameter Store and Secrets Manager backends in Apache Airflow's Amazon provider resolved a team

The Yandex Lockbox secrets backend in Apache Airflow's Yandex provider resolved a team-scoped Connection or Variable id

UnixAuth lacks brute-force protection in Apache Ranger versions <= 2.8.0.  Note:  UnixAuth is NOT a recommended option f

Logs contain replayable JWT tokens in Apache Ranger versions <= 2.8.0 Users are recommended to upgrade to version 2.9.0,

TLS hostname verification issue in Apache Ranger Client Code in versions <= 2.8.0. Users are recommended to upgrade to v

Vulnerability in tapestry-core in Apache Tapestry 5.5.0+ on all platforms allows attackers to download clsspath assets v

Missing Authentication in Apache Ranger Download APIs on versions <= 2.8.0. Users are recommended to upgrade to version

Remote Code Execution Vulnerability in GraalScriptEngineCreator in Apache Ranger <= 2.8.0 Users are recommended to upgra

Remote Code Execution via Arbitrary Class Instantiation in plugin-schema-registry component in Apache Ranger <= 2.8.0. U

Remote Code Execution via JDBC URL Injection in Apache Ranger <= 2.8.0 Users are recommended to upgrade to version 2.9.0

Privilege Escalation via URL Parameter is reported in Apache Ranger versions <= 2.8.0. Users are recommended to upgrade

SQL Injection vulnerability vulnerability in Apache Ranger. This issue affects . Users are recommended to upgrade to v

Improper Neutralization of Special Elements used in a Command ('Command Injection') vulnerability in Apache Ranger. Thi

Out-of-bounds Read vulnerability in Apache Fory C++ deserialization. This issue affects Apache Fory C++ versions from 0

Deserialization of Untrusted Data vulnerability in the Go implementation of Apache Fory allows an attacker to cause a de

Heap type confusion vulnerability in Apache Fory C++ deserialization. This issue affects Apache Fory C++ versions from

Heap-based Buffer Overflow vulnerability in Apache Portable Runtime Utility memcached client This issue affects Apache

Heap-based Buffer Overflow vulnerability in Apache Portable Runtime Utility redis client. This issue affects Apache Por

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Apache Portable Ru

A bug in APR-util version 1.6.3 (and earlier) allows a stack recursion attack against any library consumer which parses

APR-util versions 1.6.3 (and earlier) function apr_password_validate() was not constant-time with regards to hashes or p

In Apache CXF's DefaultEncryptingOAuthDataProvider, revoked access tokens still decrypt successfully, and TokenIntrospec